Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 15, 2026 · NIST NVD

   Detected

   Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.12, the /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. This vu

2. Jun 17, 2026 · NIST NVD

   Updated

   Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.12, the /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. This vu

Affected

• cpe openwebui/open webuiversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-45672

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-45672

  Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.12, the /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. T

  nvd.nist.gov

References

• Exploit · github.com